Magic Quadrant for Security Information and Event Management
SIEM is a configurable security system of record that aggregates and analyzes security event data from on-premises and cloud environments. SIEM assists with response actions to mitigate issues that cause harm to the organization and satisfy compliance and reporting requirements. The security information and event management (SIEM) system must assist with: Aggregating and normalizing data from various IT and operational technology (OT) environments; Identifying and investigating security events of interest; Supporting manual and automated response actions; Maintaining and reporting on current and historical security events.
No strategic planning assumptions provided.
Vendors must, among other requirements:
A: This research evaluates 23 SIEM vendors based on their ability to execute and completeness of vision. It assesses cloud-native/SaaS SIEM solutions that provide security information and event management capabilities including data collection, threat detection, incident investigation, case management, reporting, and advanced capabilities like SOAR, UEBA, and TIP. The research covers vendors with global presence and significant market traction in the SIEM space.
A: Security and risk management leaders evaluating SIEM providers should use this research to understand vendor positioning, strengths, and cautions. The research is particularly valuable for organizations seeking to implement or upgrade SIEM capabilities, compare vendor offerings against specific requirements, understand market trends and vendor strategies, and make informed decisions about SIEM investments based on their security operations maturity, deployment preferences (cloud vs on-premises), and specific use cases.
A: To be included in this Magic Quadrant, vendors must provide: (1) Collection of infrastructure details and security-relevant data from a wide range of assets on-premises and/or in cloud; (2) Ability for end-users to self-develop, modify and maintain threat detection use cases utilizing correlation, analytic and signature-based methods; (3) SIEM vendor content and facility for client-created content in areas including analytics, data normalization, collection and enrichment; (4) Case management and support of incident response activities; (5) Report generation to support business, compliance and audit needs.
A:
A: Ability to Execute evaluates a vendor's current product capabilities, market presence, sales success, customer experience, and operational capabilities - focusing on present performance and execution. Completeness of Vision assesses a vendor's understanding of market trends, strategic direction, innovation roadmap, and ability to anticipate future requirements - focusing on strategic vision and future positioning. Ability to Execute emphasizes tangible results and current market position, while Completeness of Vision emphasizes strategic thinking and market direction.